CVE

Affects Adobe Acrobat and Reader (Reader DC), when a crafted PDF is opened that uses embedded data objects handled by EScript.api. No fixed versions or patch ids are given in the checked facts.

CVE-2020-9715Needs attention

Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.

Do first: Workaround: The facts give no workaround. Until an update is applied, avoid opening PDF files from untrusted sources or visiting untrusted pages that open PDFs.

  • Exploitation: active
  • Automatable: no
  • Technical impact: total

Summary

Adobe Acrobat and Adobe Reader are affected by this vulnerability. A successful attack could allow an attacker to run arbitrary code on the user's computer.

Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .

Who should check

Anyone running Adobe Acrobat or Acrobat Reader DC (2020.009.20074 and earlier, plus older tracks) who opens PDFs from untrusted sources

“This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC.”

zerodayinitiative.com

cve.now Index

  • Exploitation40/40Listed in CISA's Known Exploited Vulnerabilities catalog
  • Exposure15/25Actively exploited
  • Reach?/20Unknown. No tracked technology or package matched
  • Severity8.8/10CVSS 7.8, total technical impact per CISA
  • No patch5/5No fixed version listed; see vendor advisory

What would change the score

  • Would score about 79 if CISA's SSVC rates it automatable

How the score works · Rankings

What to do

  • Workaround: The facts give no workaround. Until an update is applied, avoid opening PDF files from untrusted sources or visiting untrusted pages that open PDFs.

  • Fix it by Apr 27, 2026, CISA's deadline for US federal agencies.

    CISA's required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Workaround: The facts give no workaround. Until an update is applied, avoid opening PDF files from untrusted sources or visiting untrusted pages that open PDFs.

Fix it by Apr 27, 2026, CISA's deadline for US federal agencies.

Check your systems with an agent

Paste this into a coding or ops agent. It checks your systems read-only and reports a table per asset.

Timeline

  1. Aug 19, 2020, 12:00 AM UTCCVE published2,063 days (about 6 years)
  2. Apr 13, 2026Added to CISA KEV

    CISA has evidence of exploitation in the wild

  3. Apr 13, 2026, 5:04 PM UTCCISA SSVC assessment

    Exploitation: active · Automatable: no · Technical impact: total

  4. Apr 13, 2026, 10:20 PM UTCRecord last updated14 days
  5. Apr 27, 2026CISA remediation deadline

    Due date for US federal agencies to patch

    199 days
  6. Nov 12, 2026, 7:59 PM UTCExploit code on GitHub

    dexteon/cve-2020-9715-poc

CISA has evidence of exploitation in the wild

Exploitation: active · Automatable: no · Technical impact: total

Due date for US federal agencies to patch

dexteon/cve-2020-9715-poc

Affected versions

  • Adobe Adobe Acrobat and Reader

    Version range not reported

Version range not reported

Evidence 9

Vendor advisory · 1

Establishes: Affected and fixed versions.

  1. Linkhelpx.adobe.com · security/products/acrobat/apsb20-48.html

CVE record · 1

Establishes: The identifier and description.

  1. RecordCVE List · CVE-2020-9715

CISA KEV · 2

Establishes: Exploitation in the wild, for this CVE only.

  1. ListingCISA KEV · CVE-2020-9715, added 2026-04-13
  2. Linkcisa.gov · known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-9715

Public exploit code · 3

Establishes: Public exploit code exists (Exploit-DB, Metasploit, Nuclei and GitHub).

  1. ExploitGitHub · dexteon/cve-2020-9715-poc · Repository
  2. ExploitGitHub · f8al/PoC-CVE-2020-9715 · Repository
  3. ExploitGitHub · lsw29475/CVE-2020-9715 · Repository

Other links · 2

  1. Linkzerodayinitiative.com · advisories/ZDI-20-991
  2. Linkblog.exodusintel.com · 2021/04/20/analysis-of-a-use-after-free-vulnerability-in-adobe-acrobat-reader-dc

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about CVE-2020-9715

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-04-13, which means it has evidence of attacks. US federal agencies must fix it by 2026-04-27. Public exploit code exists (a proof of concept on GitHub). Its EPSS score, the predicted chance of exploitation in the next 30 days, reached 10% or higher by 2026-10-22.Source: cisa.gov, cve.now feed data

A use-after-free bug in the data ESObject cache of the EScript.api JavaScript module lets a crafted PDF run code in the context of the current Acrobat Reader process. The target must visit a malicious page or open a malicious file.Source: blog.exodusintel.com, zerodayinitiative.com

The description lists Acrobat and Reader 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier. The bug is reached when a PDF with embedded data objects is opened in Reader DC. The installed version can be checked in the app under Help > About Adobe Acrobat Reader.Source: blog.exodusintel.com, zerodayinitiative.com

The checked facts name no fixed version or patch id. Check Adobe's security bulletin for this CVE and update Acrobat or Reader to the latest release it lists.Source: blog.exodusintel.com, zerodayinitiative.com

The facts give no workaround. Until an update is applied, avoid opening PDF files from untrusted sources or visiting untrusted pages that open PDFs.Source: blog.exodusintel.com, zerodayinitiative.com

Sources

Known exploitation

Added to CISA KEV on Apr 13, 2026.

Remediation due Apr 27, 2026.

All Adobe entries in CISA KEV

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More CVEs